ci: make PR checks light and coalesce next integration runs

.ai/skills/hack-repo-verify/SKILL.md

@@ -131,15 +131,28 @@ Read [CI](../../../.github/workflows/ci.yml) for current hosted gates. A local p
 does not mean CI ran.
 
 Hosted CI runs the `bun run test` file set on eight `test shard i/8` jobs;
-the required `test` check is their fan-in. It accepts success and cancelled-only
-results; failure or skipped shard results still fail. Prerelease gates separately
-require every shard to succeed. The aggregate cannot distinguish cancellation
-causes from the matrix result alone; it accepts every `cancelled` result.
+light PRs run only the five Linux shards and report selected macOS paths as
+deferred to the integration run. `ci:mac`/`ci:e2e` opt into selected tiers;
+`ci:full` opts into all ordinary PR tiers. Ready Rust-input PRs retain Linux
+candidate/compiler checks while deferring macOS. Full tiers run automatically on
+ready PRs changing protected CI inputs or targeting
+`main`; the latter retains Intel. Light PRs skip build smoke, macOS and Docker;
+ordinary `next` integrations defer Intel to explicit release qualification. Deferred
+platform/Docker evidence comes from next pushes. Lead readiness requires green Linux jobs,
+clean persistent review and handled bot findings; list pending Mac/Docker jobs.
+The required `test` check is their fan-in. Every planned shard and the enabled
+Linux process-lifetime job must succeed; failure, cancellation or an unexpected
+skip fails. A planned out-of-scope lifetime skip passes. Drafts deliberately fail with
+`skipped: draft`. Next pushes can select tests only after a successful predecessor;
+superseded pushes cancel. Main and explicit full dispatches retain release-host
+coverage. Prerelease plan/publish require exact-head `release-full` evidence from
+the selected run's latest attempt, including every shard and compiler host.
 [`scripts/test-shard-plan.ts`](../../../scripts/test-shard-plan.ts) splits the files
 by the durations in `scripts/test-shard-durations.json`. A file with no recorded
 duration is planned at 5 s. Each shard runs each of its files in its own
 `bun test ./<file>` process and prints a start line and a result line per file.
-It stops a file after 12 min, and stops the shard at 30 min or on cancellation.
+It stops a file after 12 min (temporarily 20 min for storage activation command,
+run first in its shard), and stops the shard at 30 min or on cancellation.
 When it stops early it names the running file, the files not started and the
 slowest files. Each shard first checks that the eight shards cover the files
 `git ls-files` lists exactly once. To reproduce one shard locally, run

.github/actions/ci-dependency-cache/action.yml

@@ -0,0 +1,49 @@
+name: CI dependency cache
+description: Cache downloaded packages and native build dependencies without skipping verification
+inputs:
+  mode:
+    description: bun or rust
+    default: bun
+  kind:
+    description: Separate compiler and candidate target trees
+    default: compiler
+  target:
+    description: Cargo target directory to retain
+    default: .hack-local/config-compiler-target
+runs:
+  using: composite
+  steps:
+    - name: Cache Bun downloads
+      if: inputs.mode == 'bun'
+      uses: actions/cache@v4
+      with:
+        path: ~/.bun/install/cache
+        key: ci-bun-v1-${{ runner.os }}-${{ runner.arch }}-1.4.4-${{ hashFiles('bun.lock') }}
+        restore-keys: ci-bun-v1-${{ runner.os }}-${{ runner.arch }}-1.4.4-
+    - name: Identify native cache toolchain
+      if: inputs.mode == 'rust'
+      id: image
+      shell: bash
+      run: |
+        printf 'image=%s\n' "${ImageOS:-unknown}" >> "$GITHUB_OUTPUT"
+        printf 'CARGO_INCREMENTAL=0\nZIG_GLOBAL_CACHE_DIR=%s/ci-zig-cache\n' "$RUNNER_TEMP" >> "$GITHUB_ENV"
+    - name: Restore Cargo and Zig build data on pull requests
+      if: inputs.mode == 'rust' && github.event_name == 'pull_request'
+      uses: actions/cache/restore@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git/db
+          ${{ inputs.target }}
+          ${{ runner.temp }}/ci-zig-cache
+        key: ci-native-v2-${{ runner.os }}-${{ runner.arch }}-${{ steps.image.outputs.image }}-${{ inputs.kind }}-rust1.97.1-zig0.15.2-${{ hashFiles('mise.toml', 'packages/**/Cargo.lock') }}
+    - name: Cache Cargo and Zig build data on trusted events
+      if: inputs.mode == 'rust' && github.event_name != 'pull_request' && (github.ref == 'refs/heads/next' || github.ref == 'refs/heads/main' || github.event_name == 'workflow_dispatch')
+      uses: actions/cache@v4
+      with:
+        path: |
+          ~/.cargo/registry
+          ~/.cargo/git/db
+          ${{ inputs.target }}
+          ${{ runner.temp }}/ci-zig-cache
+        key: ci-native-v2-${{ runner.os }}-${{ runner.arch }}-${{ steps.image.outputs.image }}-${{ inputs.kind }}-rust1.97.1-zig0.15.2-${{ hashFiles('mise.toml', 'packages/**/Cargo.lock') }}